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The Xilinx Virtex-II Pro is a platform FPGA that embeds multiple microprocessors within 
the fabric of an SRAM-based reprogrammable FPGA. The variety and quantity of resources 
provided by this family of devices make them very attractive for spaceflight applications. However, 
these devices will be susceptible to single event effects (SEE), which must be mitigated. 

Observations from prior testing of the Xilinx Virtex-II Pro suggest that the PowerPC core has 
significant vulnerability to SEEs. However, these initial tests were not designed to exclusively target 
the functionality of the PowerPC, therefore making it difficult to distinguish processor upsets from 
fabric upsets. The main focus of this paper involves detailed SEE testing of the embedded PowerPC 
core. Due to the complexity of the PowerPC, various custom test applications, both static and 
dynamic, will be designed to isolate each unit of the processor. Collective analysis of the test results 
will provide insight into the exact upset mechanisms of the PowerPC. With this information, 
mitigations schemes can be developed and tested that address the specific susceptibilities of these 
devices. 

The test bed will be the Xilinx SEE Consortium Virtex-II Pro test board, which allows for 
configuration scrubbing, design triplication, and ease of data collection. Testing will be performed at 
the Indiana University Cyclotron Facility using protons of varying energy levels and fluencies. This 
paper will present the detailed test approach along with the results. 
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Abstract 



XRTC Board 


Daughter Card 


• Xilinx Virtex-II Pro 

- XQR2VP40-FFI 152 

- Dual PowerPCs 

- 1 5,868,256 configuration bits 

• External interfaces 

- Platform flash devices 

- JTAG/SelectMAP 

- CPU debug headers 

- RS-232 

- 2 300-pin Teradyne connectors 

- SMPXMGTs 

• Isolated power lugs 
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Motherboard 
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XRTC Board - 


2 XC2VP70 FPGAs 

- DUT configuration scrubber 

- DUT functionality monitor 
External interfaces 

- Platform flash devices 

- System ACE 

- Triple majority voted flash 

- 7 40-pin IDE connectors 

- 3 512-MB SDRAM DIMMs 

- 3 RS-232 ports 

- JTAG/Debug headers 

- MGT clock synthesizer 

- SMPX MGTs 





IUCF Test Facility 


• Indiana University 
Cyclotron Facility 

- Bloomington, IN 

- Proton beam 

• Energy: 30 - 200 MeV 

• Flux: le2- lei 1 p/sec-cm 2 

- Cable length distance to 
user area is 60-70 ft. 
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Test Setup 


Laptop #1 
[PCMGiAOj 




Radiation Chamber 
GPIB 


Laptop #2 


Laptop #3 
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Test Setup Pictures 


XRTC Board in Beam 


User Area 


LVDS Transceiver Cards 
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Test Applications 

1. Static Register/Cache Test 

- PowerPC initializes registers before each run 

- XMD used to initialize data cache before run, read out 
register and data cache after run via JTAG 

2. “Pseudo-Static” Register Test 

- FuncMon issues IRQs to DUT PowerPC at 1-Hz 

- DUT PowerPC ISR dumps all 80 register values to 
FuncMon via 32-bit GPIO data bus 

- FuncMon buffers all data received, issues IRQ to its own 
PowerPC, which dumps data out UART 

- FuncMon also counts reset events and timeout events 
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Test Application Diagram 
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Test Complications 

• Functionality not integrated for this test 

1. Configuration scrubbing 

2. Design triplication 

3. DUT PowerPC exception handlers 

• Connection failures with socketed DUT card 

- 1152-pin spring loaded socket 

- Damaged springs resulted in signal 
connections including JTAG 

- Static register/cache test was not 
possible with socketed card 
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SEE Results 


Static Test Bit-Error Results 


PowerPC Unit 

Total Bit-Errors 

Cross (cm 2 ) 

StDev 

Cross/bit (cm 2 ) 

StDev 

GPRs 

4 

4.99E-1 1 

2.50E-1 1 

4.88E-14 

2.44E-14 

D-Cache 

87 

4.34E-9 

2.33E-10 

3.31E-14 

1.78E-15 


Pseudo-Static l est SEE Results 

(Note: Each run was stopped when ihe DUT stopped responding to IRQs) 


Computation Method 

Cross (cm 2 ) StDev 

Average of 24 runs 

9.54E-10 7.5 IE- 10 


• Other observed effects: 

- Processor resets, DUT power cycling required, 
instruction jumps, program exceptions, irregular 
response to IRQs, bit-flips in SPRs 
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Discussion of Results 


• Static Test 

- Valid SEU data collected on register and cache 

- For statistical purposes, more testing is required 

- Scrubbing will keep JTAG routing valid, decreasing the 
number of “bad” runs 


• Pseudo-Static Test 

- The runs were not long enough to gather SEU data on 
the registers 

- Four runs failed during a DUT PowerPC 1SR, however. 

- No scrubbing -> all runs most likely failed due to 
configuration upsets rather than a PowerPC SEE 

- Scrubbing and exception handlers will allow SEU data to 
be collected using this IRQ design scheme 
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Future Work Plan 

• Integrate configuration scrubbing, exception 

handlers, and TMR into designs 

• Add more functionality to test applications 

- Use of dual PowerPCs for data collection 

- Ability to monitor/count program exception types 

• Advanced test applications 

- Exercise PowerPC with dynamic test 

- Preliminary PowerPC mitigation test 

• Next test date: October 17-19 @ IUCF 
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Dynamic Test 

• Purpose: to monitor the PowerPC’s effectiveness 

to continuously execute instructions and 
maintain its functionality 

• Run multiple functions 

- Time-of-Day computation 

- Matrix math operations 

- Memory operations 

• DUT command and status 

- Monitor DUT via GPIO bus and other critical status 
lines (e.g. ICURequest, Mac hineC heck) 

- Control DUT functionality via GPIO: revive DUT 
PowerPC using IRQs and resets 

- Post-run memory/register dump via JT AG 

• Conduct tests over range of clock frequencies 

14 



Petrick 


MAPLD05/P146 


Mitigating Dual PowerPCs 

Two levels of mitigation: 


1. Each PowerPC needs individual software mitigation schemes 

2. Additional hardware layer needed to compare results from both 

PowerPCs, and detect and correct PowerPC SEEs 

• Hardware Architecture • 

Software Application 

- Triplicated data paths 

- Both processors run 

- PowerPC controller core 

identical code 

• Compare PowerPC results 

- Code replication 

• Monitor PowerPC health 

• Data duplication 

• Schedule PowerPC servicing 

• Branch duplication 

• Log data and PowerPC state info 

• Result duplication 

- Command handshaking 

- Checkpoints and rollback 

• Between core and each PowerPC 

- Heartbeat generation 

• Between PowerPCs 

- Watchdog 
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